mathjs

Math.js is an extensive math library for JavaScript and Node.js. It features a flexible expression parser with support for symbolic computation, comes with a large set of built-in functions and constants, and offers an integrated solution to work with dif

Latest 15.2.0

NPM

88%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Are you affected? Scan for Free

Health Score Breakdown

Project backing

The repository is owned by an individual account rather than an organization, so there is no organizational handoff capacity shown. This is partly offset by two recent active contributors and the project's long release history.

Repo issue activity

The repository received 8 pull requests in the last month and has 70 open pull requests, although no pull requests were merged and no issues were closed during that month. Activity is present but throughput is somewhat limited.

Repo tooling

The repository uses established build tooling, but no security-scanning tools were detected. The missing scanning layer is a modest transparency and hygiene concern, not evidence of abandonment.

Workflow audit

All three workflows were analyzed with no untrusted checkouts, injection findings, or high-confidence audit findings. However, all 14 action references are unpinned, creating a modest reproducibility and workflow supply-chain gap.

Vulnerabilities

Title	Versions	Severity
CVE-2026-40897 mathjs is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes in versions 13.1.1 - 15.2.0.	13.1.1 - 15.2.0	High
CVE-2026-41139 mathjs is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes in versions 13.1.0 - 15.2.0.	13.1.0 - 15.2.0	High
CVE-2020-7743 mathjs is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes in versions 0.0.0 - 7.5.1.	0.0.0 - 7.5.1	High
CVE-2017-1001003 mathjs is vulnerable to Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') in versions 0.0.0 - 3.17.0.	0.0.0 - 3.17.0	Critical
CVE-2017-1001002 mathjs is vulnerable to Improper Control of Generation of Code ('Code Injection') in versions 0.0.0 - 3.17.0.	0.0.0 - 3.17.0	Critical

Package versions

Maintainers

josdejong

Direct Dependencies

Dependency	Last Release	Score
complex.js Version ^2.2.5	—	—
decimal.js Version ^10.4.3	—	—
seedrandom Version ^3.0.5	—	—
fraction.js Version ^5.2.1	—	—
escape-latex Version ^1.2.0	—	—